PT-2011-1232 · Perl · Xml::Atom

Florian Weimer · Published 2011-06-10 · Updated 2021-07-13 · CVE-2012-1102

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions XML::Atom versions prior to 0.39

Description The issue is related to the incorrect restriction of XML links to external objects in the XML::Atom Perl module. This allows a remote attacker to gain read access to confidential data by exploiting the vulnerability. The problem arises when the module parses XML from potentially untrusted sources without disabling external entities.

Recommendations For versions prior to 0.39, update to version 0.39 or later to resolve the issue. As a temporary workaround, consider disabling the parsing of XML from untrusted sources until a patch is available. Restrict access to sensitive resources to minimize the risk of exploitation.

Exploit

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

BDU:2022-02057

CVE-2012-1102

DSA-2424-1

Affected Products

Xml::Atom

References · 7

• 🔥 https://seclists.org/oss-sec/2012/q1/549 · Exploit
• https://osv.dev/vulnerability/CVE-2012-1102 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-02057 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2012-1102 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2012-1102 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2012-1102 · Vendor Advisory
• https://metacpan.org/release/MIYAGAWA/XML-Atom-0.39/source/Changes · Note